Ukiah Valley Medical Center

Report ID: W4N311, California Department of Public Health

Reported Entity: UKIAH VALLEY MEDICAL CENTER/HOSPITAL D

Issue:

Based on interview and document review, the hospital failed to prevent unauthorized access to one patient's protected health information.Findings:In interview on 1/25/12 at 1:30 p.m., Staff A, the Patient Financial Services Supervisor (PFS), stated that on 1/10/12, Patient 1's primary insurance company notified her that her bill for dialysis services had been denied because the bill should have been sent to the dialysis company. Staff A asked Staff B which dialysis company should have been billed, since there were two dialysis companies providing services in the hospital's area. Staff B named what she believed to be the correct company, and it was billed. On 1/18/12, the billed company notified Staff A that Patient 1 was not one of its patients. The company destroyed the bill. Staff A then updated the claim and sent it to the correct dialysis company. Staff A stated that she notified Patient 1 of the breach on 1/23/12.Document review on 1/25/12, demonstrated that Patient 1's breached protected health information consisted of her name, sex, age, date of birth, address, social security number, medical record number, and date and type of service provided. Document review on 1/25/12, confirmed that Patient 1 and the Department were notified of the breach on 1/23/12, within five business days of discovery of the error.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280